1. Field of the Invention
The present invention generally relates to providing a single sign-on capability for accessing applications in a common framework.
2. Description of the Related Art
In computing, a framework is a defined support structure in which another software project can be organized and/or developed. In computer programming, an application framework is a term usually used to refer to a set of libraries or classes that are used to implement the standard structure of an application for a specific operating system.
Separately designed applications typically require the provision of different specified credentials in order to sign-in to use the application. Multiple sign-in credentials not only slow the process of trying to use data generated in one application in another application in the framework, but also provide considerable frustration to the user who is left to store and retrieve credential information for each application upon initialization of the application. Authentication for each application may entail a custom authentication protocol, often based on posting a user's name and password.
Web applications more and more require that a user be authenticated before receiving access. As it is not atypical for a user to employ Web applications through many different sites, a great deal of time may be spent by an individual in authenticating. The need for multiple authentication in particular occurs when the web application is not provided by the individual organization. That is, when faced with web applications from multiple, independent organizations, and individual may encounter the need for multiple individual logins, a limitation that detracts for the desired convenience and seamless access which may be expected of the Web application.
U.S. Patent Publication No. 20040230831 attempts to overcome the problem of the need to provide multiple sign-ons when faced with web applications from multiple, independent organizations, in setting up a federation that refers to different organizations or realms that have agreed to standards to make user identity and entitlements portable between organizations. The communications are redirected through a client in one realm to obtain a security token that can allow the resource server in the other realm to authenticate the user for access to the Web application. In an application, a resource challenge is generated responsive to a request for access to a Web application provided by the resource server. The resource realm and the account realm share a trust policy in a federation. A security token service challenge is sent to an account security token service module of the account realm through the Web-based client, responsive to receiving the resource challenge. An account security token received from the account security token service module through the Web-based client is verified, responsive to the sending of the security token service challenge. The account security token is formatted in accordance with the trust policy in the federation. A resource security token generated by the resource security token service module through the Web-based client is sent to the resource server to authenticate the user for access to the Web application, responsive to verify the account security token.
While the system described in U.S. Patent Publication 20040230831 would allow for a passive client single sign-on for Web applications, it requires a degree of cooperation between disparate purveyors of applications which may not be easily obtained.
The credentials necessary to sign-on to different application services can very widely. Many systems were originally designed for limited access to defined numbers of clients. Private system connection applications may have been designed to require significantly weaker credentials for access, than systems that are available over public systems, such as the Internet. To upgrade the sign-on credentials of all of these applications would require significant time and effort to modify each and every application.
A single sign-on would be particularly advantageous in terms of financial data. To many professionals involved with financial transactions, time is money, as is quick reliable up-to-the-minute information. Decisions based on stale financial information can cause money to be lost which would otherwise not be lost. The time financial professionals expend in entering numerous financial websites results leads to an inaccurate picture of the overall financial state existing at one point in time (that is, the professional's snapshot includes both up-to-date and stale data).
There is therefore a need for a better method and system for allowing a single-sign on to access independently purveyed applications. In particular, there is a need for a highly secure single-sign methodology which permits wide area public access, such as through the Internet, to private access weaker credentialed sign-on applications without a need to upgrade the credential requirements for access to each of such applications.